Multiple vulnerabilities in Adobe Reader and Acrobat



Published: 2020-11-03
Risk High
Patch available YES
Number of vulnerabilities 14
CVE-ID CVE-2020-24435
CVE-2020-24433
CVE-2020-24432
CVE-2020-24439
CVE-2020-24429
CVE-2020-24427
CVE-2020-24431
CVE-2020-24436
CVE-2020-24426
CVE-2020-24434
CVE-2020-24428
CVE-2020-24430
CVE-2020-24437
CVE-2020-24438
CWE-ID CWE-122
CWE-284
CWE-20
CWE-347
CWE-427
CWE-787
CWE-125
CWE-362
CWE-416
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Adobe Acrobat DC
Client/Desktop applications / Office applications

Adobe Acrobat Reader DC
Client/Desktop applications / Office applications

Adobe Acrobat
Client/Desktop applications / Office applications

Adobe Acrobat Reader
Client/Desktop applications / Office applications

Adobe Reader
Client/Desktop applications / Office applications

Vendor Adobe

Security Bulletin

This security bulletin contains information about 14 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU48117

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24435

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing JavaScript submitForm elements in PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU48124

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24433

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can bypass implemented security restrictions and elevate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU48126

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24432

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input when processing JavaScript inside PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU48128

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24439

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect digital signature verification. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and bypass implemented security restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU48125

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24429

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application incorrectly handles digital signatures. A local user can elevate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU48127

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24427

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Insecure DLL loading

EUVDB-ID: #VU48129

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24431

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU48120

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24436

CWE-ID: CWE-787 - Out-of-bounds Write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger an out-of-bounds write and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU48122

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24426

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files within the ID parameter. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger an out-of-bounds read and gain access to sensitive information.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU48123

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24434

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger an out-of-bounds read and gain access to sensitive information.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Race condition

EUVDB-ID: #VU48130

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24428

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU48118

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24430

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU48119

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24437

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing JavaScript forms inside PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use-after-free

EUVDB-ID: #VU48121

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-24438

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error when processing PDF files within the "AVDocumentLocal object". A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and gain access to sensitive information.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005

Adobe Acrobat Reader: 2017.011.30156, 2017.011.30158, 2017.011.30171, 2020.001.30005

Adobe Reader: 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2020.001.30002, 2020.001.30005, 2020.012.20041, 2020.012.20048

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb20-67.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###